RE: Question about Active Directory and last time user has logged on

["John Hammond" <josephhammond () hotmail com>]

Mary:

The net user command gives a date and time stamp of the last time a user has 
logged in.

NET USER
[username [password | *] [options]] [/DOMAIN]
        username {password | *} /ADD [options] [/DOMAIN]
        username [/DELETE] [/DOMAIN]


> From: "Mary Hendrix" <maryhendrix () gmail com>
> To: security-basics () securityfocus com
> Subject: Question about Active Directory and last time user has logged on
> Date: Tue, 28 Aug 2007 15:36:17 -0300
> MIME-Version: 1.0
> Received: from outgoing.securityfocus.com ([205.206.231.27]) by 
> bay0-mc6-f3.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Tue, 28 
> Aug 2007 16:38:00 -0700
> Received: from outgoing.securityfocus.com by outgoing.securityfocus.com     
>      via smtpd (for mx2.hotmail.com [65.54.244.40]) with ESMTP; Tue, 28 
> Aug 2007 16:30:48 -0700
> Received: from lists.securityfocus.com (lists.securityfocus.com 
> [205.206.231.19])by outgoing3.securityfocus.com (Postfix) with QMQPid 
> 8984823B624; Tue, 28 Aug 2007 16:06:16 -0600 (MDT)
> Received: (qmail 17074 invoked from network); 28 Aug 2007 19:06:34 -0000
> X-Message-Delivery: Vj0zLjQuMDt1cz0wO2k9MDtsPTA7YT0w
> X-Message-Info: 
> JGTYoYF78jG4DjMm6IfGLGGWns4slojmbvhR/Wrwox6w1JUENN9rtT+HNPPocjGxbPSG8DSSBPlNb9qtsUMzKg==
> Mailing-List: contact security-basics-help () securityfocus com; run by ezmlm
> Precedence: bulk
> List-Id: <security-basics.list-id.securityfocus.com>
> List-Post: <mailto:security-basics () securityfocus com>
> List-Help: <mailto:security-basics-help () securityfocus com>
> List-Unsubscribe: <mailto:security-basics-unsubscribe () securityfocus com>
> List-Subscribe: <mailto:security-basics-subscribe () securityfocus com>
> Resent-Sender: listbounce () securityfocus com
> Errors-To: listbounce () securityfocus com
> Delivered-To: mailing list security-basics () securityfocus com
> Delivered-To: moderator for security-basics () securityfocus com
> DKIM-Signature: a=rsa-sha1; c=relaxed/relaxed;        d=gmail.com; s=beta;  
>       
> h=domainkey-signature:received:received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; 
>        
> b=hMT4MB6OBMeEX49inZm9+a7nSNE8fGRTyDcc9KI9cOccii2o+ox0/8yZsXKwb/E4efHa4+ESE96TIeM1LqlE1k+qjW5r63EV3pTpG91HtvrspFBBhN02xNvilPxuBcXIYslFo45ZiRoFNK37FRSXA/Z/vjqYJjgbKX4kjO6GTz8=
> DomainKey-Signature: a=rsa-sha1; c=nofws;        d=gmail.com; s=beta;       
>  
> h=received:message-id:date:from:to:subject:mime-version:content-type:content-transfer-encoding:content-disposition; 
>        
> b=fDppWqN9TFrqjdC529QnJ9PAZmnqATYI43WzXdWrzRIeg8SU184N2EbDS5fdRA2euCgMVEPJj90EBCeimbZzhoJRam2cOZWMf09hV3eROK+hN/7BwM2pqVCcjGZKwGrlNqVWR8Vp/JiuDQnDs3ecxHUdZ8GBw0gtQ5G+tTwmHVw=
> Resent-Message-Id: <20070828220616.8984823B624 () outgoing3 securityfocus com>
> Resent-Date: Tue, 28 Aug 2007 16:06:16 -0600 (MDT)
> Resent-From: security-basics-return-45520 () securityfocus com
> Return-Path: 
> security-basics-return-45520-josephhammond=hotmail.com () securityfocus com
> X-OriginalArrivalTime: 28 Aug 2007 23:38:00.0187 (UTC) 
> FILETIME=[782884B0:01C7E9CC]
>
> Is there a way to find out the last time a user has logged into a domain?
>
> Thanks in advance
>
> Mary